Middleware Engine Vulnerability in Fastify Affects Authentication Processes

CVE-2026-112712

What is CVE-2026-112712?

The @fastify/middie middleware has a path-scoping issue affecting versions 9.0.0 to 9.3.5, where the mount path for middleware may not align with the Fastify router's path. This discrepancy can lead to situations where essential path-scoped middleware—like those handling authentication and rate limiting—can be bypassed without triggering any alerts, allowing unauthorized requests to be processed. It is crucial for users to upgrade to version 9.3.6 or later to mitigate this vulnerability, or alternatively, apply stricter authorization checks in Fastify hooks.

References